Hash Generator
Compute MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes of a text, right in your browser. No data sent to any server.
Type some text to compute its hashes.
What the hash generator does
A hash function turns input of any length into a fixed-size string called a digest or fingerprint. The exact same input always produces the same hash, while the slightest change (even a single character) produces a completely different result. That's why hashes are used to verify the integrity of files and messages: if two hashes match, the contents are identical. This tool computes five widely-used algorithms — MD5, SHA-1, SHA-256, SHA-384 and SHA-512 — right in your browser.
SHA-1 and the SHA-2 family (SHA-256, SHA-384, SHA-512) are computed via the browser's native Web Crypto API, a fast and reliable implementation. MD5 is not part of Web Crypto, so it is computed with a small RFC 1321-compliant implementation. The text is UTF-8 encoded before hashing, exactly like command-line tools do, so results match md5sum, sha256sum and the like.
An important security note: MD5 and SHA-1 are considered cryptographically weak and should not be used for security purposes (such as password storage or digital signatures), as they are vulnerable to collision attacks. They remain useful and very common for integrity checks and checksums, where cryptographic security isn't required. For security needs, use SHA-256 or higher. All computation happens in your browser: no text is ever sent to or stored on a server.
A frequent use is verifying the integrity of a downloaded file: many projects publish a SHA-256 hash alongside the file, and recomputing it on your download lets you confirm it wasn't corrupted or tampered with. Hashes also underpin how Git works (identifying every commit with a SHA-1, and SHA-256 in newer versions), content-addressable cache keys, and HTTP ETag headers, which browsers use to tell whether a resource has changed without re-downloading it entirely.
A hash is not encryption: it's a one-way function — there is no way to "decrypt" a hash back to the original text (short of trying every possible input, a brute-force attack). That's exactly why general-purpose hashes like SHA-256 should never be used directly to store passwords: they're designed to be extremely fast, which makes them computable at billions per second on dedicated hardware, making dictionary or brute-force attacks on passwords far too cheap. Passwords need purpose-built functions like bcrypt, scrypt, or Argon2, deliberately slow and memory-hard. One last practical note: hashes are shown in hexadecimal (lowercase by convention), so if you're comparing two values, make sure to ignore case or normalize them first.
Frequently asked questions
- Is the text sent to a server?
- No. All hashes are computed entirely in your browser via the Web Crypto API (for SHA-1 and SHA-2) and a small local implementation (for MD5). No text is transmitted or stored.
- Can I use MD5 or SHA-1 for passwords?
- No. MD5 and SHA-1 are cryptographically weak and unsuitable for security purposes. For passwords use purpose-built algorithms (like bcrypt or Argon2); for general security needs use at least SHA-256.
- Why does the hash differ from my terminal's?
- It almost always comes down to encoding or a line-ending character. This tool UTF-8 encodes the text with no trailing newline: make sure your terminal input is identical (watch out for the \n added by echo — use echo -n).
- What is a hash used for?
- Mainly to verify integrity: comparing the hash of a downloaded file with the one published by the author confirms it hasn't been altered or corrupted. Hashes also underpin digital signatures, deduplication and data structures.